--- name: quiet-window-predicate description: "BINDING quiet-window definition: zero non-terminal CI runs AND no local cargo/rustc/nextest — gh-only drain checks are blind to local builds" metadata: node_type: memory type: feedback originSessionId: 841f2d23-f02b-4bd9-8355-d94698a03efe modified: 2026-07-30T01:57:48.857Z --- **Quiet window (standing definition, doyle-ratified 2026-07-27, todlando-authored):** a shared box is quiet only when BOTH hold: (1) zero non-terminal CI runs (`gh run list`), AND (2) no local `cargo`/`rustc`/`cargo-nextest` process alive on the box. A gh-only drain check reads clean while another agent is mid-local-build (deployah's sign step runs local xtask cargo; gates and probes run local suites) — exactly the contention class that muddied the g6 evidence twice. **Why:** the box is claimed two ways — CI scheduler AND local agent builds; watchers that fire on CI-drain alone hand you a false quiet window and manufacture timed-window flakes or muddy attribution runs. **How to apply:** every drain-waiter / quiet-window guard uses the two-predicate check; sweep or probe scripts self-refuse while either predicate fails. Kin: [[twohost-run-window-discipline]], [[measure-the-box-before-the-instrument]], [[seedmap-test-collides-live-daemon]]. **⚠ `gh run list` STATUS IS NOT AN OCCUPANCY PROBE (todlando 2026-07-29).** A run can report `queued` while its job is ALREADY EXECUTING on this box — observed with #121/#122: both runs read `queued`, while `Runner.Worker` + `cargo-nextest` were live and a suite was mid-flight. So "queued" never means "not started yet", and an idle-looking queue is not evidence of a deaf runner ([[runner-online-but-deaf]]) either. The authoritative occupancy signal is the PROCESS table: `Runner.Worker` alive ⇒ a job is running on this box; `cargo-nextest` alive ⇒ a SUITE is running, which is the [[seedmap-test-collides-live-daemon]] starvation collision. Predicate (2) already catches this — the failure mode is trusting predicate (1)'s wording ("non-terminal") to tell you WHEN a run began. **⭐⭐ ROOT FINDING (doyle 2026-07-29): this whole predicate was NOWHERE IN THE REPO.** Grepped `docs/` and `.github/` — no quiet-window definition, no clauses, no blind spots, in GOLDEN-CI.md or anywhere else. A binding gate procedure every agent is expected to apply existed only as agent memory, which is why it was misapplied twice in one day. **A binding procedure that lives only in agent memory is oral tradition, not a mechanism** — same rule as [[rule-failed-its-author-needs-a-mechanism]], applied to procedure instead of code. Routed to hertz to write into `docs/GOLDEN-CI.md` (base definition + all three clauses + the disposal rule + golden.yml's 32 GiB floor as the reason bloat is a CI failure mode, not untidiness). **When recalling this file, check whether that landed before treating the memory as the only source.** Corollary ruled the same night: a REDISCOVERY recorded as a discovery loses the mitigation someone already paid for — todlando re-surfaced the churn blind spot as "new"; it already had the CPU-seconds-delta mitigation attached. **⚠ ATTRIBUTION CLAUSE (doyle-ruled 2026-07-29, binding). The two axes are NOT independent: a CI job running on hfenduleam MANIFESTS in the local process table as `cargo`/`rustc`.** So PRESENCE of local cargo does not imply a SECOND occupant — predicate (2) can double-count the run predicate (1) already caught. Attribute the pid by walking its parent chain before counting it as new load: roots at `Runner.Worker.exe` → `Runner.Listener.exe` → `RunnerService.exe` → `services.exe` ⇒ it is the CI axis you already counted. Roots at a user shell ⇒ a genuine second local occupant, hold. Observed: todlando reported live local `cargo` pid 40488 while hertz reported BOX FREE a minute earlier — **both correct**; the chain resolved 40488 → rustup → pwsh → `Runner.Worker.exe` created at the exact start second of run 30499638578's `unit (Windows, hfenduleam)` job. Reporting a bare presence as a contradiction of a peer's report manufactures a conflict between two true observations, and can stall the only open window. Owner-query alone is not enough: the runner service account returns empty `GetOwner`/`CommandLine`, so use the chain, not the owner. **⚖ CONTENTION-ORDER RULE (doyle-ruled 2026-07-30, from deployah's collision — binding): when two jobs want the same quiet window, THE ONE WHOSE FAILURE POISONS A SIGNATURE GOES FIRST.** The case: my W-SPEC TLC sweep and deployah's release tag had *the same trigger instant* — main's thin lane going terminal — and his `git tag && git push` fires `release.yml` across BOTH runners. Ruled order: thin lane terminal → tag → release.yml terminal → draft verified → quiet re-measured → publish → *then* the `-workers auto` sweep. The deciding factor was not critical-path priority but **asymmetry of interpretation: a red in release.yml at tag time contaminates the SIGNED artifact's provenance, while a red in a fidelity sweep costs a rerun.** ⭐ Two clauses worth carrying: (1) **a peer's work finishing does not by itself make the box quiet** — the downstream waiter still re-measures the predicate at its own start moment, it does not inherit the other's clearance; (2) deployah refusing to rule his own collision, and surfacing it instead, is what made it cheap — and yielding without a ruling is cheaper still when your work is genuinely off the critical path. **State the size of what you are yielding** (mine was ~12 TLC invocations against a 123,746-state model at ~8s each — a couple of minutes, not a lane) so the other party can judge the trade instead of guessing at it. **⚠ KNOWN BLIND SPOT (todlando 2026-07-27, doyle-ratified): post-restart daemon churn.** The fleet daemon's own resume storm (reconnects, pulses, disk I/O for minutes after a restart) is real load that BOTH predicates miss — the box reads "quiet" while spt itself is churning. Found via g6: the sole red ran ~4 min post-restart on a predicate-clean box. Mitigation until a third predicate is minted: timed-window runs adjacent to a daemon restart carry fleet-spt CPU-seconds delta sampled before/after (todlando's g6 script does this) so contention is measured, not inferred.